CVE-2026-7328

Missing authorization in Caliptra Core Runtime Firmware (INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, EXTERNAL_MAILBOX_CMD commands) in subsystem mode allows a privileged local attacker to cause a denial of service via mailbox commands containing unverified AXI addresses. The security impact beyond availability is integration-specific. This issue affects Core Runtime Firmware: 2.1.0.

CVSS

No CVSS.

References

Link	Resource
https://github.com/chipsalliance/caliptra-sw/security/advisories/GHSA-c5v4-q445-wv84

Configurations

No configuration.

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Falta de autorización en el firmware de tiempo de ejecución del núcleo de Caliptra (comandos INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, EXTERNAL_MAILBOX_CMD) en modo subsistema permite a un atacante local privilegiado causar una denegación de servicio a través de comandos de buzón que contienen direcciones AXI no verificadas. El impacto de seguridad más allá de la disponibilidad es específico de la integración. Este problema afecta al firmware de tiempo de ejecución del núcleo: 2.1.0.

Information

Published : 2026-07-22 17:16

Updated : 2026-10-24 13:10

NVD link : CVE-2026-7328

Mitre link : CVE-2026-7328

CVE.ORG link : CVE-2026-7328

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-7328", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7328", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-22T18:49:34.151610Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "b01ddd03-5ef6-483b-b2c5-acba77f1a554", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "b01ddd03-5ef6-483b-b2c5-acba77f1a554", "affectedData": [{"vendor": "Caliptra", "modules": ["INVOKE_DPE_MLDSA87", "CM_AES_GCM_DECRYPT_DMA", "EXTERNAL_MAILBOX_CMD"], "product": "Core Runtime Firmware", "versions": [{"status": "affected", "version": "2.1.0", "versionType": "semver"}, {"status": "unaffected", "version": "2.1.1", "versionType": "semver"}], "packageName": "Core Runtime Firmware", "collectionURL": "https://github.com/chipsalliance/caliptra-sw", "defaultStatus": "unaffected"}]}], "published": "2026-07-22T17:16:59.557", "references": [{"url": "https://github.com/chipsalliance/caliptra-sw/security/advisories/GHSA-c5v4-q445-wv84", "source": "b01ddd03-5ef6-483b-b2c5-acba77f1a554"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "b01ddd03-5ef6-483b-b2c5-acba77f1a554", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Missing authorization in Caliptra Core Runtime Firmware (INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, EXTERNAL_MAILBOX_CMD commands) in subsystem mode allows a privileged local attacker to cause a denial of service via mailbox commands containing unverified AXI addresses. The security impact beyond availability is integration-specific.\n\nThis issue affects Core Runtime Firmware: 2.1.0."}, {"lang": "es", "value": "Falta de autorizaci\u00f3n en el firmware de tiempo de ejecuci\u00f3n del n\u00facleo de Caliptra (comandos INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, EXTERNAL_MAILBOX_CMD) en modo subsistema permite a un atacante local privilegiado causar una denegaci\u00f3n de servicio a trav\u00e9s de comandos de buz\u00f3n que contienen direcciones AXI no verificadas. El impacto de seguridad m\u00e1s all\u00e1 de la disponibilidad es espec\u00edfico de la integraci\u00f3n.\n\nEste problema afecta al firmware de tiempo de ejecuci\u00f3n del n\u00facleo: 2.1.0."}], "lastModified": "2026-10-24T13:10:00.147", "sourceIdentifier": "b01ddd03-5ef6-483b-b2c5-acba77f1a554"}